Public Sessions: fetch device robot api token during enterprise enrollment.

chrome/browser/policy/cloud/cloud_policy_client.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/policy/cloud/cloud_policy_client.h"
 
 #include "base/bind.h"
 #include "base/guid.h"
 #include "base/logging.h"
 #include "base/stl_util.h"
 #include "chrome/browser/policy/cloud/device_management_service.h"
+#include "google_apis/gaia/gaia_constants.h"
 
 namespace em = enterprise_management;
 
 namespace policy {
 
 namespace {
 
 // Translates the DeviceRegisterResponse::DeviceMode |mode| to the enum used
 // internally to represent different device modes.
 DeviceMode TranslateProtobufDeviceMode(
@@ skipping 10 matching lines @@
 
 bool IsChromePolicy(const std::string& type) {
   return type == dm_protocol::kChromeDevicePolicyType ||
          type == dm_protocol::kChromeUserPolicyType;
 }
 
 }  // namespace
 
 CloudPolicyClient::Observer::~Observer() {}
 
+void CloudPolicyClient::Observer::OnRobotAuthCodesFetched(
+    CloudPolicyClient* client) {}
+
 CloudPolicyClient::StatusProvider::~StatusProvider() {}
 
 CloudPolicyClient::CloudPolicyClient(const std::string& machine_id,
                                      const std::string& machine_model,
                                      UserAffiliation user_affiliation,
                                      StatusProvider* status_provider,
                                      DeviceManagementService* service)
     : machine_id_(machine_id),
       machine_model_(machine_model),
       user_affiliation_(user_affiliation),
@@ skipping 118 matching lines @@
             request->mutable_session_status_report_request())) {
       request->clear_session_status_report_request();
     }
   }
 
   // Fire the job.
   request_job_->Start(base::Bind(&CloudPolicyClient::OnPolicyFetchCompleted,
                                  base::Unretained(this)));
 }
 
+void CloudPolicyClient::FetchRobotAuthTokens(const std::string& auth_token) {
+  CHECK(is_registered());
+  DCHECK(!auth_token.empty());
+
+  request_job_.reset(service_->CreateJob(
+      DeviceManagementRequestJob::TYPE_API_AUTH_CODE_FETCH));
+  // The credentials of a domain user are needed in order to mint a new OAuth2
+  // authorization token for the robot account.
+  request_job_->SetOAuthToken(auth_token);
+  request_job_->SetDMToken(dm_token_);
+  request_job_->SetClientID(client_id_);
+
+  em::DeviceServiceApiAccessRequest* request =
+      request_job_->GetRequest()->mutable_service_api_access_request();
+  request->add_auth_scope(GaiaConstants::kAnyApiOAuth2Scope);
+
+  request_job_->Start(
+      base::Bind(&CloudPolicyClient::OnFetchRobotAuthTokensCompleted,
+                 base::Unretained(this)));
+}
+
 void CloudPolicyClient::Unregister() {
   DCHECK(service_);
   request_job_.reset(
       service_->CreateJob(DeviceManagementRequestJob::TYPE_UNREGISTRATION));
   request_job_->SetDMToken(dm_token_);
   request_job_->SetClientID(client_id_);
   request_job_->GetRequest()->mutable_unregister_request();
   request_job_->Start(base::Bind(&CloudPolicyClient::OnUnregisterCompleted,
                                  base::Unretained(this)));
 }
@@ skipping 72 matching lines @@
       device_mode_ = TranslateProtobufDeviceMode(
           response.register_response().enrollment_type());
     }
 
     NotifyRegistrationStateChanged();
   } else {
     NotifyClientError();
   }
 }
 
+void CloudPolicyClient::OnFetchRobotAuthTokensCompleted(
+    DeviceManagementStatus status,
+    const em::DeviceManagementResponse& response) {
+  if (status == DM_STATUS_SUCCESS &&
+      (!response.has_service_api_access_response() ||
+       response.service_api_access_response().auth_code().empty())) {
+    LOG(WARNING) << "Invalid service api access response.";
+    status = DM_STATUS_RESPONSE_DECODING_ERROR;
+  }
+
+  status_ = status;
+  if (status == DM_STATUS_SUCCESS) {
+    robot_api_auth_code_ = response.service_api_access_response().auth_code();
+    DVLOG(1) << "Device robot account auth code fetch complete - code = "
+             << robot_api_auth_code_;
+
+    NotifyRobotAuthCodesFetched();
+  } else {
+    NotifyClientError();
+  }
+}
+
 void CloudPolicyClient::OnPolicyFetchCompleted(
     DeviceManagementStatus status,
     const em::DeviceManagementResponse& response) {
   if (status == DM_STATUS_SUCCESS) {
     if (!response.has_policy_response() ||
         response.policy_response().response_size() == 0) {
       LOG(WARNING) << "Empty policy response.";
       status = DM_STATUS_RESPONSE_DECODING_ERROR;
     }
   }
@@ skipping 69 matching lines @@
 }
 
 void CloudPolicyClient::NotifyPolicyFetched() {
   FOR_EACH_OBSERVER(Observer, observers_, OnPolicyFetched(this));
 }
 
 void CloudPolicyClient::NotifyRegistrationStateChanged() {
   FOR_EACH_OBSERVER(Observer, observers_, OnRegistrationStateChanged(this));
 }
 
+void CloudPolicyClient::NotifyRobotAuthCodesFetched() {
+  FOR_EACH_OBSERVER(Observer, observers_, OnRobotAuthCodesFetched(this));
+}
+
 void CloudPolicyClient::NotifyClientError() {
   FOR_EACH_OBSERVER(Observer, observers_, OnClientError(this));
 }
 
 }  // namespace policy